CVE-2026-30863

CVE-2026-30863 is a critical vulnerability affecting Parse Server versions prior to 8.6.10 and 9.5.0-alpha.11. It stems from improper authentication in the Google, Apple, and Facebook adapters, where JWT audience validation is silently skipped if not explicitly configured. This allows an attacker to use a validly signed JWT from a different application to impersonate any user on the target Parse Server. With a CVSS score of 9.3 (CRITICAL), this vulnerability has a low attack complexity and no user interaction required, leading to high impact on confidentiality and integrity. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.